Runbooks

Runbooks for the hosted platform live in ba-infrastructure/docs/runbooks/, next to the Terraform they refer to, so a change to the infrastructure and the change to its runbook land in the same pull request. This page is the index.

Runbook	Use it when
The alerts and what to do when one fires	An email from alerts@businessaffairs.com arrives. Lists every rule, what it means, the first command to run, and how to fire one on purpose to test the mail.
Writing or reading a secret by hand	You need a value in kv-ba-staging-app set, rotated or read. Covers activating a Key Vault role through PIM for up to two hours.
Putting the API’s hostname on a container app	A new deployment, a new hostname, or a managed certificate that did not issue. The CNAME must be DNS-only and the certificate is bound once by hand.

Procedures that are not infrastructure, such as rolling an application back, are on the Deployment page until they need a page of their own.

Writing a new runbook

Put it in ba-infrastructure/docs/runbooks/ if it operates something Terraform creates, otherwise under operations/ here. Name the resource exactly as Azure or Cloudflare names it. Give the first command to run, not a description of it. Add a row to the table above.